CVE-2023-38688 twitch-tui's connection is not encrypted
Attackers can sniff unencrypted Twitch chat traffic and steal auth tokens because the client disables TLS by default.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-38688?
CVE-2023-38688 is a high-severity vulnerability in Xithrius twitch-tui, published on 4 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including auth tokens, can be sniffed. Version 2.4.1 has a patch for this issue.
Weakness: CWE-311
Which versions are affected by CVE-2023-38688?
2 open source packages ship an affected version, including twitch-tui. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
twitch-tui crates.io | All versions | 2.4.1 |
twitch-tui crates.io | All versions | 2.4.1 |
Products include Xithrius Twitch-Tui.
How do I fix CVE-2023-38688?
Upgrade twitch-tui to 2.4.1 or later.
Is CVE-2023-38688 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-38688 exists.
Sources
Also known as GHSA-779w-xvpm-78jx.